- Start by watching, not blocking. A few weeks of logs tell you which services matter and which teams use them.
- Decide per service based on its data terms: whether it trains on inputs, how long it keeps them, and where.
- Use five actions, not two: allow, allow with redaction, warn, redirect to a sanctioned tool, and block.
- Block only what is genuinely unacceptable, and make asking for a new tool quick.
- Track the share of AI use on sanctioned tools. That number tells you whether the program works.
If you are new to the topic, What is shadow AI? covers the definition, the risks and the detection methods. This page is about what to do next.
Why a ban does not hold
Blocking the well-known AI domains is the usual first move, and it rarely lasts. There are hundreds of AI services, new ones appear every week, and a phone on mobile data is outside every network control. In a June 2026 PagerDuty survey, 66% of office professionals said they had used AI tools at work they believed were not permitted.
What does change behaviour is a sanctioned option people want to use. Netskope's 2026 report found 62% of workplace AI users on company-managed accounts, up from 25% a year earlier, while use of personal accounts fell from 78% to 47%. The plan below is built around that: make the approved route the easy one, and save blocking for the few services where no amount of convenience makes them acceptable.
1. Monitor before you enforce
Run in allow-and-log mode for two to four weeks before changing anything people can feel. You want to know:
- which AI services are used, by how many people, and in which teams;
- whether people sign in with company or personal accounts;
- which services carry the most traffic, since a short list usually accounts for most of it;
- what kinds of data appear in prompts, if you can inspect them: personal data, credentials, source code, financial figures.
Firewall, DNS or secure web gateway logs are enough for the first three. Export the destination hostnames and match them against a list of AI domains. The AI Service Directory has a domain lookup for this. The last item needs traffic inspection, which comes later if it is not available yet.
Expect the list to be long. In our own deployments the median organization has 73 distinct AI services in use, and one in four has more than 120 (methodology in the State of Shadow AI report). Most of those are used by a handful of people. That is fine. The goal of this step is to find the few that matter.
2. Sort services by their data terms, not their brand
The same brand can be a low risk on an enterprise plan and a high risk on a consumer plan. What matters is what the terms say about training, retention and location. Of the 811 services documented in our directory, 132 train on customer content by default and 486 do not say whether they do. Every entry quotes the vendor's own policy, so you can check the ones on your list instead of guessing.
A tier table turns those terms into decisions:
| Tier | Typical terms | Action |
|---|---|---|
| Approved | Company contract, no training on inputs, known retention and region | Allow |
| Acceptable with limits | No training on inputs, but long or open-ended retention, or processing outside your region | Allow, with personal data and secrets removed from prompts |
| Under review | Terms unclear or not yet checked | Warn: explain the risk, let the person continue or turn back, log both |
| Has an approved equivalent | Consumer chatbots and writing tools you already offer a sanctioned version of | Redirect to the sanctioned tool |
| Unacceptable | Trains on everything submitted with no opt-out, cannot delete, or no contract possible for the data involved | Block, with a page that says why and where to go instead |
Set a default for services nobody has reviewed yet. Warn is a reasonable default during rollout, because it gives you data on demand without stopping work.
3. Offer a sanctioned tool that is as good
People use shadow AI because it helps them. If the approved tool is a slower model, without file upload or web search, they will keep using the other one. Before you redirect anyone, make sure the sanctioned option has the models they were using, the features they rely on, and no extra login steps.
A redirect then works as a guide instead of a wall: someone opens a consumer chatbot and lands in the company workspace with the same kind of model, under the company's data terms.
4. Protect the data, not just the domain
Domain decisions say nothing about what goes into a prompt. A sanctioned tool can still receive a customer list, and a tolerated one can be fine for rewriting a public blog post. Where you can inspect traffic, apply data rules to the prompt itself:
- remove or tokenize personal data, credentials and payment data before the prompt leaves;
- block prompts that contain the few data types that must never leave, whatever the service;
- log the rest, so you know what kinds of data are actually being sent.
This is also where the legal exposure sits. Under Article 28 of the GDPR, a processor handling personal data on your behalf must be bound by a contract, and a personal AI account has no contract with your organization.
5. Make the exception path fast
Every block and warning page should let the person ask for access, with a sentence on why. Requests tell you what people need, and when several people ask for the same tool, that is a signal to review it properly or offer an alternative. Agree who decides and how fast. A request that sits for three weeks teaches people to use their phone.
6. Write a short policy around the tiers
ISACA's 2026 AI Pulse Poll found that 38% of organizations have a formal, comprehensive AI policy. A policy does not need to be long to count. It should say:
- which tools are approved, and for which kinds of data;
- what may never go into any AI tool;
- how to request a new tool, and how quickly the answer comes;
- what happens when a prompt contains restricted data;
- who owns the policy and when it is reviewed.
In the EU, Article 4 of the AI Act has required providers and deployers of AI systems to take measures for AI literacy among their staff since 2 February 2025. A clear policy, and pages that explain a block or warning at the moment someone hits one, are part of that. Our AI policy generator produces a first draft you can adapt.
7. Bring apps and agents under the same rules
Shadow AI is not only chat. Developers put API keys on expense reports, coding assistants run with access to repositories, and agents connect to internal systems through MCP servers. Route this traffic through a gateway with a key per app, tied to an owner, with budgets and the same data rules as chat. Tools that can change things need their own rules, which we cover in AI agent security.
8. Measure every month
The aim is not zero shadow AI. It is knowing where it is and moving the bulk of use onto routes you can see. Six numbers are enough:
| Metric | What it tells you |
|---|---|
| Share of AI use on sanctioned tools | Whether the program is working. This is the main one. |
| Distinct AI services in use | How long the tail is, and whether new services keep appearing |
| Personal vs company accounts | How much use happens under terms you never agreed to |
| Restricted data caught in prompts, by type | Where training or tooling is needed |
| Warning pages: continued vs turned back | Whether a service under review is needed or can be blocked without fuss |
| Access request turnaround | Whether the exception path is fast enough to keep people on it |
How Unseen does this
Unseen works with the security stack you already run, without an agent on each device. For each AI service your people use, you choose one of four actions: Allow, Warn, Redirect or Block.
- Set a default action, then adjust by risk level or for a single service.
- Warn shows a branded page; people can continue for a set time. Activity records who turned back and who continued.
- Redirect sends people to Secure Chat, the company workspace with the models you enable, or to a URL you choose.
- Block and Warn pages include an access request. Requests show the reason and how many others asked for the same service, and are answered with one click.
- Data policies redact, tokenize or block personal data and secrets in prompts before they leave.
- Every change to an action is recorded in the audit trail.
Most customers start with every service on Allow, review the discovery data, and then switch on enforcement service by service. See Shadow AI visibility and control for the product, or redirecting users to approved AI for the redirect in detail.
FAQ
Can you govern shadow AI without blocking AI tools?
Yes. Most organizations block only a small number of services whose terms are unacceptable, such as services that train on everything submitted with no way to opt out. The rest are allowed, allowed with personal data and secrets removed from prompts, put behind a warning page, or redirected to a sanctioned tool. Usage then moves to the sanctioned route instead of to personal phones.
Do we need TLS inspection to govern shadow AI?
Not to start. Firewall, DNS and proxy logs show which AI services are used and by whom, which is enough for an inventory and for allow, warn, redirect and block decisions per service. Seeing or redacting what is in a prompt does require inspecting the traffic, either in the network path, in a browser extension, or through a gateway.
What should a shadow AI policy contain?
Which AI tools are approved and for which data, what is never allowed in any AI tool, how to request a new tool and how fast the answer comes, what happens to prompts that contain restricted data, and who owns the policy. Keep it short enough that people read it. A tier table that maps each class of service to an action does most of the work.
Is a warning page enough?
For services under review, often yes. A warning page that explains the risk and lets the person continue or turn back is logged either way, which tells you how many people actually needed the tool. For services with an approved equivalent, a redirect to the sanctioned tool works better, because it gives the person what they came for.
Should employees be allowed to use free ChatGPT?
That depends on the data and on the account. A personal account is covered by consumer terms the organization never agreed to, and under the GDPR personal data sent to a processor needs a contract with that processor. A common answer is to redirect the free consumer tools to a sanctioned workspace that offers the same models under a company agreement.
Start with what is actually in use
The free assessment runs step 1 against your own traffic and shows which AI services your people use and what goes to them.
Free Shadow AI Assessment